Get-NetworkStatistics - netstat -ano with filtering

This code borrows from Shay Levy's Get-NetworkStatistics function. This function runs netstat -ano on a local or remote system and filters the results by process name, address, port, protocol or state if specified. Process names are pulled for each PID using get-process.

4.8 Star
28,781 times
Add to favorites
E-mail Twitter Digg Facebook
  • Cannot get it to work.
    3 Posts | Last post October 27, 2018
    • I execute the get-networkstatistics.ps1 to implement the function. (returns no output, as expected).
      I then run: .\get-networkstatistics -computername computername
      this doesn't return any output.
      $psversiontable details:
      PS C:\temp> $psversiontable
      Name                           Value
      ----                           -----
      PSVersion                      5.1.17134.228
      PSEdition                      Desktop
      PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
      BuildVersion                   10.0.17134.228
      CLRVersion                     4.0.30319.42000
      WSManStackVersion              3.0
      PSRemotingProtocolVersion      2.3
      windows 10 version:
      OS Version:                10.0.17134 N/A Build 17134
    • I figured it out.
      To create the function I had to type this:
      . c:\temp\get-openports.ps1
      instead of
      after doing this I was able run the following command successfully:
      Get-OpenPorts -computername computername | Export-CSV "C:\temp\computername.csv"
    • Disregard the "get-openports" in my last answer... this is what I meant to post:
      I figured it out.
      To create the function I had to type this:
      . c:\temp\get-networkstatistics.ps1
      instead of
      after doing this I was able run the following command successfully:
      get-networkstatistics -computername computername | Export-CSV "C:\temp\computername.csv"
  • Getting Process Path
    1 Posts | Last post May 30, 2017
    • Script works great, but having trouble getting the path for the process name, any help would be grateful. Thanks
  • no output
    2 Posts | Last post November 28, 2016
    • Does the script really work?
      No output at all, no error message, no warning...
    • Yes, it does work.  I have used it extensively.
      Try downloading the file from the github repository.
      I've made some modifications to the original script by Cookie Monster and put them into a Pull Request here.  I've added remote credential capabilities as well as made the script compatible to query Windows 2000/XP/2003 systems remotely.  Hopefully, Cookie.Monster will take a look at the pull requests and integrate them into the master.
      The only problem I still need to work through is that the script creates a temporary "P" drive to pull the netstat data from a remote computer.  If you already have a "P" drive on the local computer the script will fail.  In the meantime, you can easily change the drive letter in the script until I can figure out a way to not relay on a temporary drive letter.
  • I've added some features to your script
    2 Posts | Last post June 02, 2016
    • Love the script.  Loved it so much I've added the PSCredentials as well as an optional UserName and Password and have the script build the PSCredentials.  So this way you can use this as part of another script and pass the PSCredentials to it or you can use it from the command line an add the -UserName parameter, which it will then prompt you for the password.
      I've also fixed this so that you can use this against older remote Windows 2000/XP/2003 boxes that are NOT in the domain.
      I'm net to GitHub and tried to figure out how to create a pull request to send you the update but I had no luck.  How can I get you the updated code?  My username on GitHub is Raetrace.
    • OK, nevermind.  I think I figured out how to upload the changes to GitHub.  Check it out and let me know.
  • Only one modification I would make.
    2 Posts | Last post April 19, 2016
    • Nice script, works awesome.  One addition I would make.  I would add the option for credentials in case you are not on a domain machine or logged on as the account with rights to the remote machine with the logged in account.  As it is the script assumes you are signed into the machine with the credentials to the remote machine.
      You can make it optional to pass to all the remote commands.  Easy way to implement all these parameters would probably be to build them into has tables to be fed to your cmdlets.  In the very beginning after getting all your parameters I would build all the inputs into the cmdlets I was using into hash tables and sparse it all that way.  Just a thought.
      The credential once is a useful one though.  I may add it myself.  :-)
    • Awesome idea, that would certainly be helpful!  Currently I've just been ensuring I'm running the PowerShell session as an account with this access, but I could see scenarios where a credential param would come in handy.
      If you do write this, and are comfortable sharing, would love a pull request on GitHub ( )
  • Doesn't work on remote PC
    2 Posts | Last post August 26, 2015
    • Yes, I can create the txt file on the remote system.  I am running PoSH as a user on the remote box with admin creds. When I use the -Computername flag, it just returns the netstats for MY LOCAL PC.  Can your script be tweeked to use the -credentials flag to pass along username & pwd?
    • Hi! Sure, will look into handling credentials. Probably won't be until mid September, on vacation for a bit : )
      Trying to understand your scenario though: Are you on computer X, using PowerShell remoting to hit computer Y, and calling Get-NetworkStatistics from that session? Posting a snippet of code might help.
  • can i run this against a list of servers?
    7 Posts | Last post August 10, 2015
    • First of all, thanks a lot for the script. This helps. I am trying to fetch netstat data (State=Established) from a around 100 Windows 2003 servers and need the output in a consolidated spread sheet. Is this possible? Script works like a charm if i pull info from a single server into CSV.
    • Hi!
      It should be possible, but each row wouldn't include the computer you ran it against. I can see that being helpful, I'll look into adding that property to the output. Might be a little while, have some back-logged fixes for other projects as well - ping me in two weeks if I haven't replied
    • As a workaround, I am currently using "-Append" switch to output data into a csv. But for many servers the script doesnt look so good, since, i have to add each line per server into a ps1 file.
      Again, the script really helps. I am running it through schedule every hour to collect dependency specific details. 
      Look forward to the modified version to run this against a bulk of servers. Great Thanks.
    • Hi, is there a quick way to load the dot source permanently? since, i will be calling the script via scheduler?
    • Wow! haven't looked at this in a long time. Results will now have a computername property so you can split them up as needed. Also added pipeline support and array input for the ComputerName parameter.
      For dot sourcing, you could consider adding the dot sourcing to your profile (this runs every time PowerShell starts), or adding it at the top of the script.
    • Thanks a ton. dot source via user profile works like a charm. Only question would be how do I run it against a bulk of servers where -computername is from txt file.
      Can I call the list of server from a file with a command like the below:
      get-content c:\serverlist.txt | get-networkstatistics | export-csv -append netstat.csv
    • ok, got around with the below:
      get-content c:\serverlist | foreach-object {get-networkstatistics} | export-csv -append C:\netstat.csv. Thanks a bunch!
  • How do allow win32Process?
    1 Posts | Last post May 01, 2015
    • When I run this script against a remote Windows Server 2012 r2 machines, everything works fine, however when I run it against a remote Windows 7 machine, it says "Could not run Get-Process -computername client-pc. Verify permissions and connectivity. Defaulting to no ShowProcessNames". I have enabled WMI through the firewall and can run win_processor and win32_DiskDrive against the windows 7 machine, however I can not run any win32_process commands against it
      I tried the Invoke_WMIMethod that is suggested in other comments both locally on the Windows 7 machine and remotely to the Windows 7 machine and so far it only works locally
      Any help would be greatly appreciated 
  • No output text file
    2 Posts | Last post April 28, 2015
    • Hi,
      I am new to powershell but have some experience using cli
      I am using this script on a local server running Windows Server 2012 r2
      I am using the command .\Get-NetworkStatistics.ps1 to run the script (I am in the right directory and running as admin) however I am getting no output text file anywhere and nothing is appearing on the screen, its just going to the next line
      Any help would be greatly appreciated
    • Hi!
      If you enjoy reading, run 'Get-Help about_Scope' and read up on scope; the topics might be dry, but the material is as solid (or more so) than any book out there.
      Long story short, check out the 'Instructions' section.  This won't run as a script, what it does is say "here's what to do when they run Get-NetworkStatistics".
      # Dot source the function (after this we can run Get-NetworkStatistics, no worrying about a ps1 file):
      . "\\path\to\Get-NetworkStatistics.ps1"
      # The space above is important.  If you don't want an absolute path, and you are in the right folder, you can do this:
      . ".\Get-NetworkStatistics.ps1"
      # Google around for PowerShell dot sourcing, or read that about_scope topic for more details.
      # You can now run get-help against it:
      Get-Help Get-NetworkStatistics -Full 
      # Or you can use it:
  • I get nothing
    5 Posts | Last post April 14, 2015
    • Hello!
      No output
      No text file
      Yes I am an admin, yes I can do WMI query as mentioned in another comment.
      PSVersion                      4.0                                                                                                                                                                                                                               
      WSManStackVersion              3.0                                                                                                                                                                                                                               
      CLRVersion                     4.0.30319.17929                                                                                                                                                                                                                   
      BuildVersion                   6.3.9600.16406                                                                                                                                                                                                                    
      PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0}                    
    • Hello!
      A few quick questions that might narrow down the issue:
      Any output at all?  Warning or error messages?
      Is the session elevated (assuming UAC)?  This should evaluate to true:
      ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")
      Are you running this on your computer, or on a remote system?
      If running against a remote system, did you change the -tempFile parameter?  The default value creates a C:\netstat.txt file on the remote system.  We then assume access to \\ComputerName\C$\netstat.exe.  If this fails, we should see an error message.  Can you Test-Path \\ComputerName\c$ ?
      I've never seen it break, but I'm assuming you can run netstat -ano on the system you intend to run this on?
    • Never mind, I got it working by making it a module and importing it.
    • Never mind, I got it working by making it a module and importing it.
    • No output, No text file
      Can access remote computer C$
      Changed $tempfile variable to match my environment
      Successfully ran Invoke-WmiMethod -class Win32_process -name Create -ArgumentList "cmd /c echo blah > C:\temp.txt" -ComputerName YourComputerNameHere
      How can this be so difficult?
1 - 10 of 16 Items